The table below lists the filter term operators that appear in the filter term form’s drop-down list.
Note
The RANGE oprator requires two parameters, both Cmp Val0 and Cmp Val0 must be provided when using this operator.
Operator | Description |
---|---|
EXACT | Exact match. |
IEXACT | Case-insensitive exact match. |
CONTAINS | Case-sensitive containment test. |
ICONTAINS | Case-insensitive containment test. |
IN | In a given list. The Cmp Val0 value must be provided as a comma separated list in square brackets, e.g. [1,2,3] to compare a list on numeric values. String values must be in quotes e.g. ['critical', 'major']. |
LT | Less than. This works on numeric and string event attribute values. |
LTE | Less than or equal to. |
GT | Greater than. |
GTE | Greater than or equal to. |
NE | Not equal to. |
STARTSWITH | Case-sensitive starts-with. |
ISTARTSWITH | Case-insensitive starts-with. |
ENDSWITH | Case-sensitive ends-with. |
IENDSWITH | Case-insensitive ends-with. |
REGEX | Case-sensitive regular expression match. |
IREGEX | Case-insensitive regular expression match. |
RANGE | Inclusive range test. |
The table below lists some example behaviour expected whern using the filter term operators.
Operator | Cmp Val0 value | Event attr value | Event in result? |
---|---|---|---|
EXACT | server | server1 | False |
EXACT | server1 | server1 | True |
IEXACT | server1 | SerVer1 | True |
CONTAINS | server1 | server1 | True |
CONTAINS | erver | server1 | True |
IN | [‘critical’,’major’] | major | True |
IN | [‘critical’,’major’] | minor | False |
IN | [10, 20, 30] | 33 | False |
IN | [10, 20, 30] | 10 | True |
LT | 5 | 10 | True |
LT | 10 | 10 | False |
LT | aaa | aaaa | True |
LT | bbb | aaaa | False |
LTE | 10 | 10 | True |
GT | 15 | 10 | True |
GT | 10 | 10 | False |
GTE | 10 | 10 | True |
NE | foo | bar | True |
STARTSWITH | f | foo | True |
STARTSWITH | oo | foo | False |
ISTARTSWITH | f | Foo | True |
ENDSWITH | oo | foo | True |
ENDSWITH | fo | foo | False |
IENDSWITH | r | baR | True |
REGEX | ^critical$ | critical | True |
REGEX | ^critical$ | critical... | False |
IREGEX | ^critical$ | Critical | True |
The table below lists some example behaviour expected whern using the filter term RANGE operator.
Operator | Cmp Val0 value | Cmp Val1 value | Event attr value | Event in result? |
---|---|---|---|---|
RANGE | 10 | 100 | 99 | True |
RANGE | 10 | 100 | 101 | False |
RANGE | 10 | 100 | 9 | False |
RANGE | a | c | b | True |
RANGE | a | c | d | False |